platform/tenant-registry
2
0
Fork 0
Code Issues Pull Requests 2 Actions Packages Projects Releases Wiki Activity

fix(deps): clear the HIGH/CRITICAL CVEs failing the trivy CI gate #15

Open
sharang wants to merge 1 commits from fix/trivy-dependency-bumps into main
pull from: fix/trivy-dependency-bumps
merge into: :main
Conversation 0 Commits 1 Files Changed 2
+43 -60
sharang commented 2026-08-24 23:01:44 +00:00
Owner
Copy Link
Copy Source

The required 'shared' check has been red on every run for months — root cause was not CI infrastructure but 14 real HIGH/CRITICAL dependency findings. This bumps kin-openapi (CRITICAL fail-open), golang.org/x/crypto (ssh CVEs), golang.org/x/text, and moby/go-archive to fixed versions. Full suite incl. postgres testcontainers green.

🤖 Generated with Claude Code

The required 'shared' check has been red on every run for months — root cause was not CI infrastructure but 14 real HIGH/CRITICAL dependency findings. This bumps kin-openapi (CRITICAL fail-open), golang.org/x/crypto (ssh CVEs), golang.org/x/text, and moby/go-archive to fixed versions. Full suite incl. postgres testcontainers green. 🤖 Generated with [Claude Code](https://claude.com/claude-code)
sharang added 1 commit 2026-08-24 23:01:45 +00:00
fix(deps): bump kin-openapi, x/crypto, x/text, go-archive past HIGH/CRITICAL CVEs
ci / shared (pull_request) Successful in 12s
Details
ci / test (pull_request) Successful in 21m14s
Details
ci / image (pull_request) Skipped
Details
47c6725dba 
Clears the 14 findings (13 HIGH, 1 CRITICAL) that have had the trivy fs
gate in the shared CI job red on every run: kin-openapi 0.138.0 -> 0.144.0
(GHSA-r277-6w6q-xmqw ValidationHandler fail-open + CVE-2026-76905),
x/crypto 0.51.0 -> 0.55.0 (ssh CVE-2026-39828..39835, 42508, 46595,
46597), x/text -> 0.41.0 (CVE-2026-56852), moby/go-archive 0.2.0 -> 0.3.0
(CVE-2026-17106). Full suite incl. postgres harness green; openapi
contract test passes against kin-openapi 0.144.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
All checks were successful
ci / shared (pull_request) Successful in 12s
Required
Details
ci / test (pull_request) Successful in 21m14s
Details
ci / image (pull_request) Skipped
Details
This pull request doesn't have enough required approvals yet. 0 of 1 official approvals granted.
You are not authorized to merge this pull request.
View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.
git fetch -u origin fix/trivy-dependency-bumps:fix/trivy-dependency-bumps
git checkout fix/trivy-dependency-bumps
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
No items
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
Benjamin_Boenisch sharang (Sharang Parnerkar)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: platform/tenant-registry#15